KR100745639B1 - Method for protecting file system and registry and apparatus thereof - Google Patents

Abstract

The present invention relates to a file system and a registry protection method and apparatus for detecting and removing malware. The present invention includes the steps of periodically collecting attack signature information at an application level, recording the collected attack signature information in a database, searching the file system, (1) a value recorded in the database and If the same value is included in the search result for the file system, detecting the attack by the malware and removing the corresponding information, and (2) a value equal to the value recorded in the database is stored in the file system. Searching for the registry when the search result is not included in the search result and when the search result for the registry includes the same value as the value recorded in the database, detecting the attack by malware and removing the information. Providing a file system and registry protection method comprising the steps of: All. According to the present invention, by detecting and removing malicious codes for the file system and the registry, it is possible to prevent malicious behavior that can be performed in the system in advance, so that the server, the intranet, and the client are installed in the server and the client system in the client / server environment. Improve the stability of the environment.

 File system, registry, malware, detection, removal, restore

Description

METHOD FOR PROTECTING FILE SYSTEM AND REGISTRY AND APPARATUS THEREOF}

1 is a diagram showing the configuration of a system for removing malicious code based on the Windows kernel according to the present invention.

2 is a diagram illustrating a process of searching for malicious codes in a file system and a registry in the file system and registry protection method according to the present invention.

3 is a diagram illustrating a flow of a file system and a registry protection method according to an embodiment of the present invention.

4 is a diagram illustrating a file system and a registry protection device according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: Malware Removal System

111: File and Registry Check Module 112: Kernel Memory Check Module

113: kernel driver check module 114: process check module

120: user mode

121: File system 122: Registry

130: kernel mode

131: kernel memory 132: kernel driver

400: file system and registry protection device

410: collector 420: database

430: search unit 440: comparison unit

450: processing unit 460: storage unit

The present invention relates to a method and apparatus for protecting a file system and a registry, and more particularly, to a method and apparatus for protecting a file system and a registry for detecting and removing malware.

Typically, malicious code refers to programs designed for malicious purposes such as system destruction, information leakage, and forgery. Such malicious code can be classified into viruses, worms, malicious mobile codes (eg, applet, activeX), and the like. In addition, malicious code may be classified into malware of an application layer and malware based on a kernel according to a computer system layer.

The malware of the application layer can be detected and removed by an existing information protection system such as an antivirus, which is based on the presence of an attack signature in the system.

The study of attack techniques based on such known attack signatures is a concept that emphasizes the security life-cycle response, and the study of unknown kernel attack techniques is a concept focused on prevention. In the light of the latest trends in information protection technology, proactive approaches are more important than proactive approaches.

Kernel attack techniques related to the Windows environment can be broadly classified into system object and subject information hiding techniques, system control flow changes and malware addition techniques, and kernel driver manipulation techniques. The level of countermeasures against attack techniques is studied only on a limited platform for each individual technique, and there are no studies on integrated security management, intelligent architecture, and framework.

This lack of relevant research is due to various problems, such as the lack of Windows kernel-related information, the difficulty of operating system kernel programming techniques, and the stability of the system. However, research on countermeasures against diversified and advanced kernel attacks is an active alternative in the coming ubiquitous era.

The following describes the typical operation of kernel-based malware in the operating system. First, the malicious code accesses the operating system system through a network using a vulnerability of an operating system system, installs a kernel backdoor on the operating system system, and then recognizes the operating system system using the kernel backdoor. Without access, you can secretly perform malicious activities. In other words, the kernel-based malicious code first conceals the object and subject information related to itself through the kernel backdoor to conceal its existence so that it can perform its intended malicious function at any time without the knowledge of the operating system. .

The control flow of a general operating system system generates an interrupt call through a kernel when a Windows application program requests a system service in the operating system system, and executes a service machine code for the request.

Kernel-based malware alters the normal system control flow of the Windows operating system, inserting attack code that hides its existence. This operation of changing the kernel function control flow is a process of changing a function pointer, in which the input parameters and output parameters of the original kernel function and the changed kernel function are exactly matched. However, changing the original kernel function control flow is the process of changing the function pointer. If the data types do not match exactly inside the kernel, a system crash occurs.

This is an attack technique that specifies the command execution address in the attacker code by changing the service descriptor in the Windows service table. Since the malicious code is executed at the kernel level, any malicious behavior can be performed by studying the authority to execute the system.

The kernel information hiding technique, which is a representative function of kernel-based malware, is to release information of an attack code process from a link in a double-linked list, which is operating system kernel information. The attack code process information disappears from the system after the link is released, thereby concealing the existence of the attack code. In other words, the kernel-based malware changes the normal system control flow of the Windows operating system and inserts attack code in the middle of the system control path to conceal its existence.

As such, the system information of the kernel-based malicious code is concealed, and since there is no pattern for the kernel attack technique, it is very difficult to detect and remove by the existing information protection system.

Code executed at the Windows operating system level is executed in kernel mode, and an application program using the win32 API is a program executed in user mode. The kernel mode and the user mode are determined in the Descriptor Privilege Level (DPL) field of the segment descriptor.

The segment descriptor of the Intel microprocessor has a DPL field indicating the execution permission value of the script. Among these descriptors, the DPL value of the currently executing code segment (CS) descriptor is specifically designated as a CPL ( Current Privilege Level) and this value is the authority to execute the currently executing code.

If the DPL value of the currently executing code segment descriptor is '0', this code is executed in kernel mode and can refer to all instructions and all memory references of the processor. Kernel-based malware refers to malware that operates while the DPL value is '0'.

The characteristics of the kernel-based malware compared to the malware of the application layer are as follows. Application layer code provides the ability to hide the attacker's traces by altering applications at the end user level or by changing the process's memory. However, kernel-based malware hides traces of attackers by manipulating data between the Windows Native API (ntdll.dll, kernel32.dll, user32.dll) kernel drive, which is the kernel level of the Windows operating system, and WIN32 applications.

Therefore, the malware detection system of the existing application layer that detects malware by searching file magic number, system registry value, process name, driver name, etc. in a specific location in the file is a kernel-based malware. There is a problem that cannot be detected.

Due to malicious attacks by such malware, financial losses are also enormous. In particular, in the case of personal computer security, how to detect malicious code that has an active characteristic called superworm has emerged as a very important issue away from coping with current viruses.

Most of the information breach related to such malware occurs in Microsoft's Windows, and the frequency of incidents is increasing year by year. In 2003, 78 percent of all breaches worldwide occurred in Windows, according to a report by the Computer Security Institute (CSI) in the United States. In Korea, 68 percent of all breaches occurred in Windows in 2003, and 73 percent of all breaches occurred in Windows in August 2004.

As such, there is an urgent need for a method for detecting and removing malicious codes frequently occurring at the Windows kernel level.

The present invention has been made to improve the prior art as described above, and an object of the present invention is to provide a method for detecting and removing malicious code written at the kernel level by inspecting the file system and the registry.

In order to achieve the above object and to solve the problems of the prior art, the present invention includes the steps of periodically collecting attack signature information at the application level, recording the collected attack signature information in a database, and searching the file system And (1) if the same value as the value recorded in the database is included in the search result for the file system, detecting the attack by the malware and removing the corresponding information; (2) Searching for the registry if the same value as the value recorded in the database is not included in the search result for the file system, and if the search result for the registry includes the same value as the value recorded in the database. Detecting the attack by the malware and removing the information. Provides file system and registry protection methods.

According to another aspect of the present invention, an apparatus for protecting a file system and a registry may include a collecting unit that periodically collects attack signatures, a database that records the collected attack signature information, and a search unit that searches the file system or the registry. And a comparison unit for comparing a value recorded in the database with a result obtained by searching the file system or the registry, and a value equal to a value recorded in the database is included in the search result for the file system or the When the same value as the value recorded in the database is included in the search results for the registry, characterized in that it comprises a processing unit for detecting and removing malicious code.

Hereinafter, a method and a device for protecting a file system and a registry according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing the configuration of a system for detecting and removing Windows kernel-based malware according to the present invention.

Referring to FIG. 1, the malware removal system 110 includes a file and registry check module 111, a kernel memory check module 112, a kernel driver audit module 113, and a process check module 114.

The file and registry checking module 111 detects and removes malicious code at the user level by inspecting the file system 121 and the registry 122 of the user mode 120. The file and registry check module 111 periodically collects the attack signatures, even if the kernel-based malicious code leaves an attack signature that is the minimum trace. The file and registry checking module 111 records the collected attack signature information in a database and searches the file system and the registry. The file and registry inspection module 111 compares the search results of the file system and the registry with the collected attack signature information, and removes the information by considering it as an attack detection.

In addition, the file and registry checking module 111 detects and blocks intrusions to malicious code by periodically comparing file system information in a clean state with current file system information. The safe state may include an initial state in which a system is not installed or an intrusion into a malicious code. That is, the file and registry checking module 111 compares the original hash value for the file system and the registry in the safe state with the current hash value for the current file system and the registry, and compares the current hash value with the current hash value. Can be replaced with the original hash value.

The file system 121 and the registry 122 are targeted for most of the attacks, including kernel-based malware. The malicious code accesses the file system 121, installs a back door, and stores registration information in the registry 122 for automatic execution later. Therefore, the malware removal system 110 checks the malware in the file system 121 and the registry 122 before detecting and removing the kernel-based malware at the kernel level.

In order to prevent the operating system kernel functions and variables loaded in the kernel memory 131 from being manipulated or changed, the kernel memory check module 112 detects an attack behavior by comparing a kernel memory value in a safe state with a current kernel memory value. Block it. That is, the kernel memory check module 112 includes a kernel memory 131 including an interrupt call gate Interrupt Descriptor Table Register (IDTR) and an Interrupt Descriptor Table (IDT), a system call service descriptor Service Descriptor Table (SDT), and a process and thread structure ETHREAD. ) Is detected and if it is changed, it is restored to a safe state.

The kernel memory check module 112 automatically performs a region check on the kernel memory 131 according to a user input or a user's setting. The kernel memory check module 112 dumps the current kernel memory value and compares the dumped result with a safe kernel memory value previously stored. If the comparison result is the same, the kernel memory check module 112 considers that the current kernel memory dump is in a safe state. In addition, if the comparison result is not the same, the kernel memory check module 112 replaces the stored secure kernel memory value to restore the current kernel memory. Restoring the kernel memory is a process that changes the control flow of the system instructions, which is very likely to cause a system crash. Therefore, it is necessary to avoid operating system-level mutual exclusion from critical sections to restore kernel information accurately and safely. The mutual exclusion method is used.

Since kernel-based malware is produced as a kernel driver, the kernel driver checking module 113 generates a reliable kernel driver list and detects and deletes or blocks a suspected kernel driver. The kernel driver checking module 113 compares the searchable driver list through the kernel structure with the searchable kernel driver list using the API in the user mode, and detects and removes the hidden kernel driver when it is not the same. The kernel driver checking module 113 automatically detects a driver hidden by user input or user setting, and calls the Win32 ToolHelp API to retrieve the first kernel driver list in real time. In addition, the kernel driver checking module 113 calls the PsLoadModulelist in kernel mode to retrieve the second kernel driver list through the kernel structure. The kernel driver checking module 113 compares the first kernel driver list with the second kernel driver list, and detects and removes the hidden kernel driver when it is not the same.

The kernel driver checking module 113 searches for a previously created access control list according to a kernel driver loading request by a program so that an abnormal kernel driver cannot be loaded when the path to be loaded does not correspond to a confidence interval.

The kernel driver check module 113 constructs an access control list for a trusted interval and an untrusted interval for the kernel driver. The kernel driver checking module 113 loads the kernel driver normally in the kernel region when the kernel driver to be loaded is a driver of a confidence interval with reference to the access control list. The kernel driver checking module 113 processes the kernel driver from being loaded in the kernel region when the kernel driver is a driver of an untrusted interval with reference to the access control list.

The process inspection module 114 searches for concealed processes and related information at the operating system level, removes suspected malicious processes and related information, and controls and manages the right to execute the process.

The process inspecting module 114 compares the first process list searched in real time with the second process list searched through the kernel structure, and detects and removes a hidden process if it is not the same.

In addition, the process checking module 114 detects and removes the concealed process if it is not the same by comparing the third process list searched through ActiveProcessLinks and the searched fourth process list by searching ETHREAD.

2 is a diagram illustrating a process of searching for malicious codes in a file system and a registry based on an attack signature according to an embodiment of the present invention.

Referring to FIG. 2, in operation 210, the malware removal system periodically collects attack signature information at an application level.

In step 220, the malware removal system records the collected attack signature information in a database. The attack signature information may include at least one of a file path, a file name, a registry name, a registry version, and a registry value.

In step 230, the malware removal system searches for a file system according to a user input or a user's setting.

In step 240, the malicious code removal system determines whether the result of searching the file system matches the attack signature information recorded in the database. That is, the malicious code removal system may determine whether a value equal to the value recorded in the database is included in the search result of the file system.

If the search result of the file system matches the attack signature information recorded in the database, in step 241, the malware removal system detects an attack by the matching attack signature information. That is, when the malware removal system includes a value equal to the value recorded in the database in the search result of the file system, it is regarded as an attack detection.

In step 242, the malicious code removal system removes the corresponding information according to the attack detection, and continues searching for the file system.

If the search result of the file system does not match the attack signature information recorded in the database, in step 250, the malware removal system searches the registry. That is, if the same value as the value recorded in the database is not included in the search result for the file system, the malware removal system performs a search for the registry again after completing the search for the file system. .

In step 260, the malicious code removal system determines whether the result of searching the registry matches the attack signature information recorded in the database. That is, the malware removal system determines whether a value equal to the value recorded in the database is included in the search result for the file system.

If the result of searching the registry matches the attack signature information recorded in the database, in step 261, the malware removal system detects an attack by the matching attack signature. That is, when the malware removal system includes a value identical to the value recorded in the database in the search result of the registry, it is regarded as an attack detection.

In step 262, the malware removal system removes the corresponding information according to the detected attack, and then performs a search for the registry again.

If the result of searching the registry does not match the attack signature information recorded in the database, the malware removal system considers that there is no malicious code for the registry. That is, when the value identical to the value recorded in the database is not included in the result of searching the registry, the malicious code removal system terminates the search for the registry because there is no malicious code for the registry.

3 is a diagram illustrating a process of checking the integrity of a file system and a registry according to an embodiment of the present invention.

Referring to FIG. 3, in step 310, the malware removal system detects malware by an attack signature through a process as illustrated in FIG. 2.

In operation 320, the malicious code removal system determines whether the file system and the registry are in a safe state according to a result of performing the malicious code detection.

If the file system and the registry are not in a safe state, step 325 removes malware for the file system and the registry.

If the file system and the registry are in a safe state, in step 330 the malware removal system dumps the safe file system and the registry.

In step 340, the malware removal system inputs the dumped safe file system and the registry into a one-way hash function, and inputs a hash value that is a result output from the hash function to the file system of the safe state. And store it as the original hash value for the registry. The malware removal system considers a safe state if a value identical to a value recorded in the database is not included in a search result for the registry, and outputs the file system in the safe state and a hash function for the registry. The stored original hash value.

In step 350, the malware removal system dumps the current file system and registry.

In step 360, the malware removal system stores the current hash value output by applying a hash function for the dumped current file system and the registry.

In step 370, the malware removal system determines whether the original hash value and the current hash value are the same. That is, the malware removal system periodically compares the original hash value with the current hash value and determines whether the original hash value and the current hash value match.

If the original hash value and the current hash value are not the same, the malware removal system replaces the current hash value with the original hash value in step 380.

If the original hash value and the current hash value are the same, the malware removal system considers that there is no forgery or tampering with the file system and the registry and ends the system state check.

4 is a diagram illustrating a file system and a registry protection device according to an embodiment of the present invention. The file system and registry protection device 400 includes a collection unit 410, a database 420, a search unit 430, and a comparison. The unit 440, the processing unit 450, and the storage unit 460 are included.

Referring to FIG. 4, the collecting unit 410 periodically collects attack signature information on the file system and the registry. The attack signature information may include at least one of a file path, a file name, a registry name, a registry version, and a registry value.

Database 420 records the collected attack signature information.

The search unit 430 searches the file system and the registry.

The comparison unit 440 compares the value recorded in the database 420 with the result of searching the file system and the registry. In addition, the comparison unit 440 compares the original hash value for the file system and the registry in the safe state with the current hash value for the file system and the registry in the current state.

The processor 450 determines whether the same value as the value recorded in the database 420 is included in the search result for the file system or the same value as the value recorded in the database 420 according to the comparison result of the comparator 440. The malware is detected and removed when it is included in the search results for the registry. In addition, the processor 450 replaces the current hash value with the original hash value when the original hash value and the current hash value do not match according to the comparison result of the comparator 440.

The storage unit 460 stores the original hash value output by applying a hash function to the file system and the registry when a value identical to a value recorded in the database 420 does not include a search result for the registry. do. In addition, the storage unit 460 stores the current hash value output by applying a hash function to the current file system and the registry.

Embodiments of the invention also include computer-readable media containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The medium or program instructions may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above-described embodiments, which can be variously modified and modified by those skilled in the art to which the present invention pertains. Modifications are possible. Accordingly, the spirit of the present invention should be understood only by the claims set forth below, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

According to the present invention, unknown signatures can be easily removed by detecting attack signatures on file systems and registries by collecting attack signature information.

In addition, according to the present invention, by detecting and removing malicious codes for the file system and the registry, it is possible to prevent malicious behavior that can be performed in the system in advance, so that the server, the intranet, the client are installed in the server and the client system in the client / server environment Improve the safety of the operating environment.

Claims (6)

delete In the method of protecting file system and registry, Collecting application-level attack signature information and recording it in a database; Searching the file system; If the same value as the value recorded in the database is included in the search result for the file system, detecting the attack by the malware and removing the information; If a value equal to the value recorded in the database is not included in the search results for the file system, (1) detecting the attack by the malicious code and removing the information when the registry includes the same value as the value recorded in the database by searching the registry; (2) storing the original hash value output by applying a hash function to the file system and the registry when a value identical to a value recorded in the database is not included in the registry by searching the registry; Periodically comparing the current hash value for the current file system and the registry with the original hash value; and if the original hash value and the current hash value do not match, comparing the current hash value with the original hash value. And replacing with a hash value. The method of claim 2, The attack signature information includes at least one of a file path, a file name, a registry name, a registry version, and a registry value. A computer-readable recording medium for recording a program for executing the method of claim 2 or 3 on a computer. delete A device for protecting file systems and registries, A collecting unit periodically collecting attack signatures; A database for recording the collected attack signature information; A search unit for searching the file system or the registry; A comparison unit comparing a value recorded in the database with a result value of searching the file system or the registry; When a value equal to a value recorded in the database is included in a search result for the file system or a value equal to a value recorded in the database is included in a search result for the registry, the malware is detected and removed. Processing unit; And If a value identical to the value recorded in the database is not included in the search result for the registry, the original hash value output by applying a hash function to the file system and the registry is stored, and the current file system and the registry are stored. A storage for storing a current hash value, And the processor compares the original hash value with a current hash value for the current file system and the registry, and replaces the current hash value with the original hash value if there is a mismatch.

Images